Skip to main content
Comply Defense
Category: Cryptography & Encryption

Post-Quantum Cryptography

Also known as: PQC, quantum-proof cryptography, quantum-safe cryptography, quantum-resistant cryptography
Simply put

Post-Quantum Cryptography (PQC) refers to a new generation of encryption methods designed to protect information against the potential future threat of attacks from quantum computers. Because quantum computers could eventually break many of the cryptographic protections in use today, PQC aims to provide algorithms that remain secure even against that capability. It is generally described as a defense measure rather than a guarantee, and specific approved algorithms continue to evolve.

Formal definition

Post-Quantum Cryptography (PQC) is the development and deployment of cryptographic algorithms intended to withstand cryptanalytic attacks by both classical and future quantum computers. According to NIST, PQC algorithms are based on mathematical problems believed to be resistant to quantum attack, distinguishing them from classical public-key schemes vulnerable to quantum algorithms. NIST's PQC project leads the national and global standardization effort to secure electronic information against the anticipated quantum threat, while CISA's PQC Initiative coordinates government and industry partners to address the associated security and migration risks. This entry covers the concept only; readers should verify the current set of standardized or recommended PQC algorithms, applicable federal migration guidance, and specific implementation or authorization requirements against current official NIST and CISA sources, as this terminology and the associated standards continue to evolve.

Why it matters

Much of the public-key cryptography protecting government and defense information today relies on mathematical problems that a sufficiently capable quantum computer could eventually solve. NIST describes post-quantum cryptography as a defense against potential cyberattacks from quantum computers, meaning the concern is anticipatory: the goal is to migrate to quantum-resistant algorithms before a practical quantum threat materializes, rather than after data has already been exposed. This forward-looking posture matters because encrypted information can be captured and stored now for potential decryption later once quantum capability arrives.

For defense and public sector organizations, the significance is amplified by the long lifecycle and high sensitivity of protected data. NIST's PQC project is positioned as leading the national and global effort to secure electronic information against the future quantum threat, and CISA's PQC Initiative brings government and industry partners together to address the associated security and migration risks. These parallel efforts signal that PQC is treated as a coordinated, cross-sector migration challenge, not a single product or one-time fix.

Because the standards and the set of approved algorithms continue to evolve, treating PQC as a settled requirement would be a mistake. PQC is generally described as a defense measure rather than a guarantee, and adopting an algorithm does not by itself constitute compliance or security. Organizations should track current NIST standards and CISA migration guidance rather than assuming that any particular algorithm selection is final or that quantum resistance eliminates the need for broader cryptographic and system-level controls.

Who it's relevant to

Information System Security Managers and System Owners
Those responsible for the cryptographic protections in a system need to understand PQC as an emerging migration obligation. Because PQC standards and approved algorithms continue to evolve, security managers should monitor current NIST standards and CISA migration guidance and plan for cryptographic transitions rather than assuming existing public-key protections will remain sufficient against a future quantum threat. This entry covers the concept only and does not establish implementation or authorization requirements.
Authorizing Officials and Compliance Officers
Officials making risk-based decisions should recognize that adopting PQC algorithms is a defense measure rather than a guarantee, and that using a quantum-resistant algorithm is not equivalent to overall system security or to compliance with any specific requirement. Any applicable federal migration guidance and its effect on authorization should be verified against current official NIST and CISA sources, as this area is still developing.
Government Contractors and Solution Providers
Vendors and contractors handling government and defense information should track the evolving PQC standardization effort led by NIST and the coordination work of CISA's PQC Initiative. Because the set of standardized or recommended algorithms and associated migration expectations continue to change, contractual and implementation specifics should be confirmed against current authoritative sources rather than assumed from vendor claims of being 'quantum-safe.'
Auditors and Assessors
Personnel evaluating cryptographic controls should treat PQC as an evolving standards area, verifying claims of quantum resistance against the current NIST-standardized or recommended algorithms rather than against fixed assumptions. Assessors should also distinguish the concept of PQC from the broader question of whether a system's cryptographic implementation and migration approach meet applicable, current federal guidance.

Inside PQC

Quantum-Resistant Algorithms
Cryptographic algorithms designed to remain secure against attacks by both classical and quantum computers. NIST has led a standardization process to select and publish such algorithms; practitioners should verify the current published standards and their designations against official NIST sources, as the algorithm suite and naming may evolve across revisions.
NIST Standardization Effort
The National Institute of Standards and Technology conducts the process to evaluate, select, and publish post-quantum cryptographic standards. NIST is the issuing body for these standards; readers should confirm which specific standards documents are finalized versus still in draft as of the applicable revision.
Cryptographic Agility
The capability of a system to transition between cryptographic algorithms and key sizes with minimal disruption. Cryptographic agility is generally regarded as a prerequisite for a manageable migration to PQC, since algorithm selections and parameters may change over time.
Migration and Transition Planning
The organizational process of inventorying cryptographic assets, prioritizing systems, and planning phased replacement of quantum-vulnerable cryptography. The scope and timeline of migration requirements may differ across federal civilian systems under FISMA, DoD systems under the RMF, and national security systems, so applicable obligations should be confirmed against current authoritative guidance.
Harvest-Now-Decrypt-Later Threat Model
The risk that adversaries collect encrypted data today with the intent to decrypt it once cryptographically relevant quantum computers become available. This threat model is frequently cited as a driver for early migration of data with long confidentiality lifetimes.

Common questions

Answers to the questions practitioners most commonly ask about PQC.

Does deploying post-quantum cryptography mean my systems are protected against all quantum-related threats today?
No. PQC algorithms are designed to resist attacks from cryptographically relevant quantum computers, but adopting them does not make a system quantum-proof in an absolute sense, nor does it address other elements of a security program. Cryptographic algorithm strength is only one control among many; PQC does not substitute for access control, configuration management, or continuous monitoring. Additionally, PQC standards continue to evolve, so an implementation should be verified against the current authoritative guidance rather than assumed to be permanently sufficient. Compliance with a cryptographic requirement is not the same as being secure overall.
Is post-quantum cryptography the same thing as quantum cryptography or quantum key distribution (QKD)?
No, these are distinct concepts and should not be conflated. Post-quantum cryptography refers to classical cryptographic algorithms that run on conventional computing hardware and are designed to resist attack by quantum computers. Quantum cryptography, including quantum key distribution, relies on quantum-mechanical properties and specialized hardware to establish keys. PQC and QKD address related concerns through fundamentally different mechanisms, and guidance from cryptographic standards bodies treats them separately. Readers should confirm which approach a given requirement or product actually refers to.
How should an organization begin planning a migration to post-quantum cryptography?
A common starting point is developing a cryptographic inventory that identifies where and how cryptography is used across systems, data at rest and in transit, and third-party components. This inventory generally supports prioritization based on data sensitivity and the expected protection lifetime of the information. Because the specific algorithms, parameters, and timelines are set by the applicable standards and any agency-specific tailoring, organizations should align migration planning with current authoritative guidance rather than a fixed internal assumption. Implementation specifics should be verified against the governing publications in effect at the time of planning.
What is meant by 'harvest now, decrypt later' and why does it affect migration urgency?
This term describes a scenario in which an adversary collects encrypted data now with the intention of decrypting it later once sufficiently capable quantum computing becomes available. For information with a long confidentiality lifetime, this concept generally raises the priority of transitioning to quantum-resistant protection sooner rather than waiting, because data protected only by quantum-vulnerable algorithms today could remain exposed in the future. Prioritization based on required protection duration is a planning consideration; specific risk determinations should be made against current organizational and authoritative guidance.
What is crypto-agility and why is it relevant to PQC adoption?
Crypto-agility generally refers to designing systems so that cryptographic algorithms and parameters can be updated or replaced with limited disruption. Because PQC standards and recommended parameters may continue to change across revisions, building the ability to swap algorithms is often treated as a way to reduce the cost and risk of future transitions. This is an architectural and engineering consideration; the extent to which it is required or recommended depends on the applicable guidance and any agency tailoring, which should be confirmed against current official sources.
How does PQC relate to compliance obligations for systems handling CUI or operating under the RMF?
Cryptographic protection requirements for federal and defense systems derive from the governing frameworks and control sets applicable to that system, and how PQC fits into those obligations depends on the current versions of those authorities and any agency-specific tailoring. Scope also differs across federal civilian systems, DoD systems under the RMF, systems handling CUI, and classified national security systems, so a single approach should not be assumed to apply uniformly. This entry does not address implementation, contractual, or specific control-mapping details; readers should confirm applicable requirements against the current authoritative text for their system category.

Common misconceptions

Post-quantum cryptography requires a quantum computer to run.
PQC algorithms are designed to run on conventional classical computing hardware; they are intended to resist attacks from quantum computers, not to require quantum computers for their own operation.
Migrating to PQC is unnecessary until large-scale quantum computers actually exist.
Because of the harvest-now-decrypt-later threat model, data with long confidentiality requirements can be at risk today. Organizations generally need to begin inventory and planning activities before cryptographically relevant quantum computers arrive, and specific timelines should be verified against current official guidance.
Adopting a NIST post-quantum standard automatically makes a system compliant across all federal and defense programs.
Publication of a standard by NIST does not by itself establish which control baselines, authorization requirements, or contractual clauses apply to a given system. Applicability differs across FISMA-governed civilian systems, DoD RMF systems, and national security systems, and readers should confirm requirements against the governing authority for their environment.

Best practices

Maintain a current cryptographic inventory that identifies where and how quantum-vulnerable algorithms are used across systems, applications, and data flows.
Design for cryptographic agility so that algorithms, key sizes, and parameters can be updated as PQC standards are finalized or revised.
Prioritize migration for data and systems with long confidentiality lifetimes to mitigate harvest-now-decrypt-later exposure.
Track NIST's post-quantum standardization outputs directly, verifying whether specific standards are finalized or still in draft rather than relying on secondary summaries.
Confirm applicable requirements against the governing authority for your environment, since obligations may differ for civilian systems under FISMA, DoD systems under the RMF, and national security systems.
Treat PQC migration as a phased program with continuous monitoring rather than a one-time change, and validate implementation details against current official sources before making binding decisions.